Information Input Validation SI-10
System and Information Integrity · Moderate baseline ✗ Not implemented
Status — program-wide
What references this control
No risks name this control in their Framework field yet.
No policies reference it yet.
Link a risk or policy to this control
Attaching adds SI-10 to the item's Framework field; the ✨ AI button suggests the best match. You can also edit the Framework field on a risk / policy directly.
Source: NIST SP 800-53 Rev.5, System and Information Integrity family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.
Control guide — plain-English, per NIST SP 800-53
SI-10 (Information Input Validation) is about not trusting input blindly: check that the data coming into your applications is the right kind, length, and format before you act on it. Bad input is how injection attacks — SQL (Structured Query Language) injection, command injection, cross-site scripting — get in, so validating it closes a large class of holes. It is a technical control, mostly at the application layer, in the Moderate baseline.
What good looks like
- Decide which inputs you check — web form fields, uploaded files, API (Application Programming Interface) parameters, and anything a user or another system supplies.
- Validate on the server, not just in the browser — client-side checks are for convenience and are easily bypassed.
- Prefer allowlists (accept only known-good patterns) over blocklists, and check type, length, range, and format.
- Use safe patterns that stop injection: parameterized queries for databases, and escaping or encoding on output.
- Add a web application firewall such as ModSecurity as a second layer — it backs up validation but does not replace it.
Framework mapping
- NIST CSF 2.0 — PR.DS-10 — The confidentiality, integrity, and availability of data-in-use are protected
How to move it toward Implemented
- In the application, add server-side validation on every input (type, length, range, format) and switch database calls to parameterized queries.
- Install ModSecurity with the OWASP (Open Worldwide Application Security Project) Core Rule Set in front of the web server as a backstop, moving it to blocking mode after tuning.
- Send a known-bad input (for example a stray quote character in a form field) and confirm it is rejected and logged, then save that log.
- Attach that validation log as hardening evidence on the asset, naming
SI-10in the Requirement field — that moves it from ‘To assess’ toward ‘Completed’.